Rubric: 20 points
| Criterion | Points | Full-credit evidence |
|---|---|---|
| Observation and risk | 5 | Working baseline response/status (1), failure baseline response/status (1), two unnecessary diagnostic details (1 each), and a plausible explanation of real-world exposure without inventing leaked credentials (1). |
| Configuration repair | 4 | Correct boolean change (2), records saving (1) and restarting the server (1). |
| Verification | 5 | Repaired failure response retains 503/code without diagnostics (2), normal response remains 200/operational (1), and complete output shows all four checks passing (2). |
| Security explanation | 4 | Explains server-side boundary versus UI hiding, configuration versus dependencies, honest failure status, and limits of one setting (1 point each). |
| Clear evidence and reflection | 2 | Complete readable submission (1) with one sensible additional deployment-review concern (1). |
Award partial credit for correct portions. A screenshot alone without response/status context is incomplete evidence. Do not require package installation, CVE Lite output, paid AI, or polished visual design. Repaired code alone does not earn observation, verification or explanation points.
Discussion-only fallback: if a learner cannot run Node, use the supplied examples to teach the concepts, but do not award hands-on verification points for copied examples. Arrange a supported lab run for the full assessment, or announce a separate discussion-only assessment in advance. Do not present a discussion-only submission as verified execution.